When you delete a file on a Linux system, it isn’t necessarily gone forever, especially if you just recently deleted it.
Unless you rubbed it out with a tool such as shred, the data will still be sitting on your disk—and one of the best tools for recovering deleted files, testdisk, can help you rescue it. While testdisk has a wide range of functionality including recovering lost or damaged partitions and making non-booting disks bootable again, it’s also frequently used to restore files that were deleted by mistake.
In this post, we’ll take a look at how you can recover deleted files using testdisk and what each step in the process looks like. Since the process requires quite a few steps, you’re likely to feel more comfortable running through them once you’ve done it a few times.
Installing testdisk
Install testdisk with commands like apt install testdisk or yum install testdisk. Interestingly, it’s not just a Linux tool but is also available for MacOS, Solaris and Windows as well.
Documentation is available at cgsecurity.org.
Recovering files
First of all, you have to be logged in as root or have sudo access to use testdisk. If you don’t have sudo access, you’ll get kicked out early in the process, and your logfile, if you chose to create one, will end up with a message like this in it:
Credits: Networkworld
